A weekly 30 minute patch review works when it follows a fixed agenda: new advisories, items past their clock, stuck work, expiring exceptions, and next week's rollouts. Put OS and dependency items on one list sorted by risk, and leave with an owner and date for each open item.
Who attends
Keep it small: one person from infrastructure, one or two from service teams, and one security or risk owner. Rotate the chair so the meeting does not depend on one person.
The agenda
| Minutes | Topic | Question to answer |
|---|---|---|
| 5 | New items | What was published or detected since last week that touches us? |
| 8 | Past the clock | What has missed its deadline, and why? |
| 7 | Stuck work | What is blocked: tests failing, restart window, no fix? |
| 5 | Exceptions | What expires in the next two weeks? |
| 5 | Next week | Which rollouts and windows are planned? |
Prepare the list in advance
One list, one sort order. Include the layer (host, image, application), the service, the severity, the age and the owner. A view sorted by risk keeps the discussion on the items that matter. If the list is longer than the meeting can handle, your intake is too noisy and you should tune it rather than extend the meeting.
Rules that keep it short
- No new analysis in the meeting. If an item needs digging, assign it.
- Every open item leaves with an owner and a date.
- A decision, not a status. Patch, mitigate, accept with expiry, or escalate.
- Escalate by clock, not by volume. An item past its deadline gets a named senior owner.
- Record in the same place every time. The tracker is the minutes.
Questions that surface problems
- Which hosts are installed but not restarted?
- Which dependency pull requests are open longer than a week?
- Which services have no rebuild in the last month?
- Which exceptions have no review date?
- What did we learn from last week's slowest fix?
NIST SP 800-40 Rev. 4 recommends tracking exceptions closely and reviewing them regularly, and choosing metrics that fit each audience. This agenda gives both a regular home.
Monthly add on
Once a month, spend ten minutes on trends: median time to fix by layer, open exceptions, and how many fixes needed an emergency. Fewer emergencies usually means routine patching is working.
Where Safeguard fits
Safeguard's vulnerability management and continuous monitoring views can feed the list for the application layer. See also a ten minute monthly routine to keep your software safe.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how findings can be sorted by risk and assigned.
Quick check
Is weekly too often?
For a small team a fortnight can work. Keep the clock honest: nothing past deadline waits for the next meeting.
Who decides to accept a risk?
Name the role in your policy, usually a security or engineering lead, and record the expiry date.
Sources
Last reviewed: 19 October 2026.
